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Quantum mechanics predicts the existence of intrinsically random processes. Contrary to classical 
randomness, this lack of predictability can not be attributed to ignorance or lack of control. Here 
we find the optimal method to quantify the amount of local or global randomness that can be 
extracted in two scenarios: (i) the quantum steering scenario, where two parties measure a bipartite 
system in an unknown state but one of them does not trust his measurement apparatus, and (ii) the 
prepare-and-measure scenario, where additionally the quantum state is known. We use our methods 
to compute the maximal amount of local and global randomness that can be certified by measuring 
systems subject to noise and losses and show that local randomness can be certified from a single 
measurement if and only if the detectors used in the test have detection efficiency higher than 50%. 


One of the most distinct features of quantum mechan¬ 
ics is its intrinsically random character. While in classical 
mechanics lack of predictability can always be associated 
to ignorance or lack of control of the probed systems, the 
rules of quantum physics say that one can not predict 
the outcome of a measurement even if all the variables of 
a system are known. This inherent unpredictability has 
been exploited in different applications such as quantum 
random number generation [1] and quantum key distri¬ 
bution [2]. 

Recent results have shown that the randomness ob¬ 
served in quantum mechanics can be certified even with¬ 
out relying on any modelling of the quantum devices 
used for the generation of the random data. In fact, 
by analysing the data obtained in experiments involv¬ 
ing local measurements on bipartite entangled systems 
one can prove that no one could have predicted this 
data in advance whenever a Bell inequality violation is 
observed [3, 4]. This is called device-independent ran¬ 
domness certification [5, 6]. The device-independent 
approach has the practical advantage that it does not 
rely on the exact description of the experimental set¬ 
up. This is crucial when implementing cryptographic 
protocols as an adversary can use a mismatch between 
the theoretical description and the actual implementa¬ 
tion of the set-up to fake its performance [7-9]. However, 
device-independent protocols require low levels of noise 
[4], which make them very demanding experimentally. 

An intermediate scenario is that of quantum steering 
[10, 11]. It refers to the case where two parties, say Al¬ 
ice and Bob, apply local measurements on an unknown 
bipartite system. While one of them. Bob, has complete 
knowledge of his measurement apparatuses, Alice does 
not, and treats her measuring device as a black box with 
classical inputs and outputs. Quantum steering has been 
receiving lot of attention recently due to the fact that it 
allows for entanglement detection which is more robust 
to noise and experimental imperfections than Bell nonlo¬ 
cality [11, 12]. Moreover, quantum steering was shown to 


be useful for one-sided device independent quantum key 
distribution [13] and randomness certification [14]. Sev¬ 
eral experimental groups have recently observed steering, 
including in continuous-variable systems [15, 16], using 
Bell local states [17], using inefhcient detectors [18-20], 
asymmetric states [21], and multipartite systems [22-24]. 

The main result of our paper is a general and opti¬ 
mal method to quantify the amount of local or global 
randomness that can be certified from a single measure¬ 
ment in a steering experiment. We use this method to 
show that local randomness can be certihed provided that 
the detectors used have efficiency higher than 50%. Our 
method can be seen as the analogue of the approach of 
[25, 26] from the fully-device-independent scenario ap¬ 
plied to the steering scenario. We compare the results 
obtained there to those obtained here, in terms of the 
amount of randomness that can be obtained by measur¬ 
ing systems subjected to white noise, and find substantial 
benefits can be obtained in the present setting. As a by¬ 
product, we also show that the amount of randomness 
certified in Ref. [14] from the two-qubit Werner state is 
optimal. 

We furthermore show that the results can be easily 
extended beyond the steering scenario, to the prepare- 
and-measure scenario, where the state is also trusted, so 
that only Alice’s measuring device is untrusted. In this 
case we show that even noisy states can perform very well 
for randomness certification. 

Finally, we give a method to find the best measure¬ 
ments which obtain the most randomness from any fixed 
state. Using insight from this method, we show ana¬ 
lytically that all pure partially entangled states lead to 
maximal randomness certification using only two fixed 
measurements. 

There are several motivations to quantify the amount 
of randomness in the steering scenario. From a funda¬ 
mental point of view, it is important to understand how 
much randomness can be maintained if we give up partial 
information about the specific description of the systems 
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[14, 27, 28]. From a practical point of view, the amount 
of randomness obtained in the steering scenario gives an 
upper bound to what Alice and Bob would obtain in a 
fully device-independent setting, regardless of the num¬ 
ber of measurements Bob would apply. Furthermore, it 
is a scenario that appears naturally in some asymmetric 
applications. For instance the present results give a way 
of quantifying the amount of randomness in remote un¬ 
trusted stations. This is relevant, for instance, when the 
provider of a quantum-random-number generator wants 
to remotely check if the devices they provided are still 
functioning properly. 

I. STEERING AND RANDOMNESS 

The scenario we treat in this work is the following [11]: 
two parties, Alice and Bob, are located in distant labo¬ 
ratories and receive a bipartite system from a source. 
One of the two parties, say Alice, does not trust her 
measuring devices, which are treated as “black boxes”. 
She can, nevertheless, choose which measurement to per¬ 
form, which she labels by x G {0, ...,mA — 1}, each 
of which provides an outcomes, which she labels a G 
{0, ...,nA — 1}. The other party. Bob, has complete 
knowledge of his device, which allows him to perform 
quantum state tomography on his part of the system, 
and thus to obtain a complete description of his sub¬ 
system (see Fig. 1 (a)). The states reconstructed by 
Bob will usually depend on Alice’s input and output as 
Pa\x = TrA[(Ma|„, (g) lB)pAB]/Pia\x), where pab is the 
unknown state shared with Alice, P{a\x) is the prob¬ 
ability that Alice observes outcome a given she chose 
X, and is the corresponding (unknown) element of 
Alice’s measurement. The set of unnormalized states 
cra\x = P^A[iMa\x ® 1b)/Oab] = Pa\xPia\x) is Called an 
assemblage and can be completely determined by Bob 
through tomographic measurements. 

As noticed in [11], Bob can determine if pab is entan¬ 
gled by looking at the form of the assemblage {cra\x}a,x- 
This is because separable states can only lead to assem¬ 
blages with the specific form 

(^ajx = ( 1 ) 

A 

where A is a hidden variable distributed according to 
g(A), which determines both Alice’s response P(a|a:, A), 
and the states sent to Bob, cta. Assemblages of this form 
are said to have a Local Hidden State (LHS) model. Any 
assemblage which does not have this form can be detected 
through the violation of a steering inequality [29] (simi¬ 
lar to a Bell inequality or an entanglement witness) or a 
simple semi-definite program [30]. 

It turns out that the confirmation of steering not 
only guarantees that the shared state is entangled, but 
also that Alice is performing incompatible measurements 
[31, 32]. It is thus very intuitive to expect a relation 
between steering and randomness: first, the correlations 



FIG. 1. Setup for randomness certification in the quantum 
steering and prepare-and-measure scenarios, (a) Steering sce¬ 
nario: Alice and Bob measure an unknown bipartite system 
delivered by an untrusted source. Alice treats her measure¬ 
ment device as a black box with inputs x G {0,..., to-a — 1} 
and outputs a G {0,. .. ,nA — 1} and Bob performs tomog¬ 
raphy on his subsystem, (b) Prepare-and-measure scenario: 
similar to the previous scenario, but now Bob holds the source 
and then knows the bipartite state pab- 

(entanglement) shared between Alice and Bob allows Bob 
to certify steering, and consequently the incompatibility 
of Alice’s measurements. Second, since Alice’s measure¬ 
ments are incompatible not all the outcomes she receives 
are predictable, and thus random. 


II. LOCAL RANDOMNESS CERTIFICATION 

In order to certify the local randomness of Alice’s out¬ 
comes we work in the adversarial scenario, where a po¬ 
tential eavesdropper. Eve, wants to predict them. This 
framework is relevant for cryptographic tasks, namely 
ISDIQKD. In the most general case, we do not make 
any assumption on Alice’s measurement device, so that 
it could even have been provided by Eve. We also con¬ 
sider that the state pab is the reduced state of a tripar¬ 
tite entangled state pabe shared by Alice, Bob and Eve, 
i. e. PAB = TrE [pabe] ■ Hence, by applying measurements 
to her subsystem Eve can in principle obtain information 
about Alice’s outcome. 

In this section we will focus on the case where Al¬ 
ice and Bob want to extract randomness from the out¬ 
comes of a single given measurement of Alice, let us say 
X* G {0,..., TOA —!}• The motivation for considering this 
case is that it is the relevant one from the perspective of 
ISDIQKD. We assume that the runs of the experiment 
are independent and identically distributed with respect 
to Eve’s strategy^. We consider the case where Eve also 
knows from which measurement x* Alice is going to ex¬ 
tract randomness, so she can optimise her attack to ob¬ 
tain information about this measurement setting. The 


^ We note that once independence is assumed, it is without loss of 
generality to assume the pairs identical. 
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figure of merit we use to evaluate the amount of random¬ 
ness in Alice’s outcomes is the probability that Eve can 
correctly guess the outcome a of the measurement x* of 
Alice. This quantity, denoted by Pguess(a^*), is given by 
the probability that Eve’s guess e is equal to the out¬ 
come a that Alice obtained, whenever Alice performs the 
specific measurement x = x*: 

Pguessix*) = ^PA(a = e|a;*)PE(e|a = e,x = x*). (2) 

e 

Applying Bayes theorem, this is equivalent to 
Pguessix*) = Yie^AEia = e,e\x = X*), i.e. equal 
to the joint probability that Alice and Eve give the same 
outcome whenever Alice measures x = x*. Randomness 
is certified whenever the guessing probability is strictly 
less than 1, in which case Eve can not predict Alice’s 
outcome with certainty. 

After Alice and Eve have applied their measurements 
the assemblage prepared will be 

^l\x = TrAE[(Afa|a; 0 1 b <8) Mg) pabe], (3) 

where Mg is the element of Eve’s (optimal) measurement 
which yields outcome e S {0,..., riA — !}• However, since 
Alice and Bob do not have access to Eve’s outcomes the 
assemblage they will reconstruct will be given by 

= ( 4 ) 

e 

In order to compute the optimal strategy for Eve 
we need to maximise her guessing probability (for a 
given input x* of Alice), over all strategies. Naively, 
this would appear to constitute optimising the triple 
{PABE, Me}, of state, measurements for Alice, and 
measurement for Eve, a non-linear optimisation prob¬ 
lem. However, just as in the device-independent case 
[25, 26], we can instead replace this by an equivalent lin¬ 
ear optimisation over all physical assemblages {cr®|^}a,e,a: 
that are compatible with the no-signalling principle and 
the observed assemblage More precisely, the 


maximisation problem can be formulated as 
semidefinite programme (SDP) [33]: 

the following 

7’guess(a:*) = max E 4’i'[o'a=e|x*] 

(5) 

s-t. E<k = <l^ 

e 

y a,x 

^ ^ ^a\x ^ ^ ^a\x' 

a, CL 

y e, X ^ x' 

<\x h 0 

Va, x, e. 


In the objective function we used P'Eie)PAio\x,e) = 
P{ae\x) = Tr[(T®|^] to re-express Pguess(a^*)- The first 
constraint assures that the decomposition for Eve is com¬ 
patible with the assemblage Alice and Bob observe. The 
second constraint is the non-signalling condition - i.e. 


Alice cannot signal to Bob and to Eve. The last one 
is the requirement for every (T®|^ to be a valid (unnor¬ 
malized) quantum state. We defer to the appendix the 
full proof that this optimisation problem is equivalent to 
optimising over states and measurements, which follows 
from the Gisin-Hughston-Jozsa-Wootters (GHJW) the¬ 
orem [34] (which shows that all bipartite no-signalling 
assemblages have quantum realisations), combined with 
the fact that Eve, making only one measurement, also 
cannot signal. 

Notice that the SDP (5) can be seen as the steering 
analogue of the SDP provided in [25, 26] which bounds 
the amount of randomness given an observed nonlocal 
probability distribution Po\,siab\xy). As mentioned be¬ 
fore, the SDP (5) provides an upper bound on the amount 
of randomness (i.e. a lower bound on the Pguess) that can 
be found using the SDP of [25, 26]. This follows because 
(5) does not allow Eve to attack the measurements of 
Bob. Thus, our SDP bounds the maximal amount of ran¬ 
domness that could be obtained if Bob were to perform 
any number of measurements (that Eve can attack) and 
compute the randomness based on the obtained proba¬ 
bility distribution. The number of random bits is quanti¬ 
fied by the min-entropy H^in{A\X) = -log^ P*^gggix*), 
where Pguessix*) is the result of the maximization (5). 

In Fig. 2 we plot the amount of randomness certified in 
the case that Alice applies two mutually unbiased Pauli 
spin measurements on a two-qubit Werner state pab = 
?;|4'+)($+| -h (1 -u)l/4, where |$+) = (|00) -k \ll))/y/2, 
and compare it with the amount of randomness obtained 
in the case Bob also treats his measuring device as a black 
box (i.e. the fully device-independent case). In both 
cases randomness can be certified as long as u > l/-\/2, 
which is the critical amount of noise for demonstrating ei¬ 
ther steering or nonlocality with only two measurements 
[35]. All numerical SDP calculations were performed us¬ 
ing the CVX package for MATLAB [36], along with the 
library QETLAB [37]. 

In Fig. 3 we also compute the amount of randomness 
that can be obtained by measuring the same spin mea¬ 
surements with detection efficiency rj (for visibility v = 1 
and V = 0.9), again comparing to the case where Bob 
treats his measuring device as a black box. That is, (for 
steering) instead of ideal measurements, with elements 
Maixj we consider inefficient measurements with 

one additional outcome a = 0, given by 


M^}^ = 

a\x 


'n^a\x, 

(1-77)1, 


a^0 
a = 0 


( 6 ) 


(the measurements of Bob are similarly made inefficient 
in the nonlocality scenario). 

In this case, two comparisons are made: (i) the case 
where Bob’s detection efficiency is 1; and (ii) where Bob 
also has detection efficiency rj. As one can see, for 
7 ; = 1 in the steering scenario randomness can be cer¬ 
tified whenever the detection efficiency is higher than 
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FIG. 2. Random bits certified Hmin versus the visibility v 
of the two-qubit Werner state. We compare the randomness 
obtained with our method in the steering scenario (solid line) 
with the fully-device-independent case as in [25] (dashed line). 



FIG. 3. Random bits certified iFmin versus the detection effi¬ 
ciency Tj for the two-qubit Werner state. Black lines: u = 1; 
Red lines: v = 0.9. Solid lines: our steering method; Dot- 
dashed lines: DI method in the case where Bob’s detection 
efficiency is 1; Dashed lines: DI method where both Alice and 
Bob’s detectors have efficiency rj. 


50%, matching the threshold below which no random¬ 
ness can be obtained [38]. Moreover, we see that due to 
the much larger detection efficiencies needed to violate 
the CHSH inequality (82.8%) and for the DI case where 
Bob’s measuring device is perfectly efficient (70.7%), the 
steering scenario offers a significant advantage when us¬ 
ing the maximally entangled state over the nonlocality 
scenario, for the entire range of visibility which is exper¬ 
imentally significant (i.e. for v = 0.9 and above). 

Finally, in Fig. 4 we plot the number of random bits 
certified in the case that Alice performs measurements 
in four mutually unbiased bases on her half of the en¬ 
tangled two-qutrit state (|00) -b |11) -b |22))/-\/3 in the 
presence of losses. Again, we see that whenever the de¬ 
tection efficiency is above 50% Alice is able to certify local 
randomness. Moreover, for efficiency rj = 1 she certifies 
Hmin = log 2 3 bits of randomuess. 



FIG. 4. Random bits certified i7min versus the detection 
efficiency rj for the two-qutrit maximally entangled state 
|$5,'’) = (|00) + |11) + |22))/V3. 



FIG. 5. Global randomness obtained by measuring a two- 
qubit Werner state (with noise v), with X and Z measure¬ 
ments for Alice, and X measurement for Bob, computed us¬ 
ing Eq. (7) (solid curve). As a matter of comparison we also 
plot the amount of global randomness obtained in the device¬ 
independent scenario, using the methods of Refs. [25, 26] 
(dashed curve). 


III. GLOBAL RANDOMNESS CERTIFICATION 

In the steering scenario one can also consider global 
randomness extraction from both the untrusted and 
trusted devices. Indeed, even though Bob trusts his de¬ 
vices, and knows which measurement he performs, there 
is still an optimal state that Eve can distribute which 
allows her to predict the outcome of Bob’s measurement. 
This is because although Eve is not able to change the 
measurements performed by Bob, nor his reduced state, 
she still has additional classical side information that she 
can use to help her in guessing the result of Bob (since 
she holds the source). 

Consider that, additionally to Alice’s measurement 
X = X*, Eve wants to guess the outcomes of a mea¬ 
surement Mb performed by Bob. Eve now has a pair 
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of guesses (e, e'), which will be her guess for the pair 
(a, b) . She will thus perform a measurement with ele¬ 
ments Mee' on her share of the state, which after Al¬ 
ice also measures will lead to the assemblage for Bob 
0 1 b ® Mee')pABE]- Similarly to the 
case of local randomness, the global guessing probability 
Pg can straightforwardly be shown to be the solution to 
the following SDP 


Pguessix*) = max^Tr[Mt,=e'<=e|x*] 



(7) 

Va, X 
^ x', a, e, e' 
Va, X, e, e' 


We again require consistency with the observed assem¬ 
blage cr°j’^, and demand positivity and no-signalling. 

We computed the global randomness which can be cer- 
tihed without losses assuming X and Z measurements 
for Alice, and an X measurement for Bob, on two-qubit 
Werner states. The results can be seen in Fig. 5, along¬ 
side the corresponding curve calculated using the method 
of Refs. [25, 26] for the nonlocality scenario. As a result, 
we observe that the lower bound on the amount of global 
randomness that can be extracted in the steering scenario 
presented in Ref. [14] is tight. 


IV. PREPARE-AND-MEASURE SCENARIO 

Up to now we have considered the steering scenario, 
where Alice and Bob receive an unknown state pab from 
an untrusted source. It turns out that the results on lo¬ 
cal randomness straightforwardly apply to the case where 
Bob prepares a known state and sends half of it to Al¬ 
ice (see Fig. 1 (b)). In this case, since the global state 
Pab is known, the assemblages reconstructed by Bob 
have to come from unknown measurements on this state, 
i.e. aa\x: = Z]eTrA[(Af®|^ (g) 1 b)pab]- Thus the SDP (5) 
can be replaced by 

Pguessix*) = max^Tr[(M^^^|^. (g) 1 b)pab] (8) 

e 

s.t.^TrA[(M®|,^ (g 1 b)pab] = <1^, Va,a; 

e 

a a 

a,e 

^ 0 

This SDP can be understood as the maximisation of 
Eve’s guessing probability over all possible POVM mea¬ 
surements (where the outcome e goes to Eve and the 


Vx' ^ x,e 
Vx 
Va, X, e 



FIG. 6. Plot of the random bits certified versus the number 
of steps of the see-saw iteration for a two-qubit partially en¬ 
tangled state \ip) = cos0|OO) -I- sin6^111) with 9 — -k jl and 
starting with random measurements with rj — 1 (black curve) 
and ri — 0.9 (red curve). 


outcome a goes to Alice), with Eve oblivious of x, that 
can be applied to the state pabj given the observation of 
the assemblage {<x^^}a,x- A derivation of this SDP can 
be found in B. We note that this scenario can also be 
thought of as the ‘time-like steering’ scenario introduced 
in Ref. [39]. 

We used the above program to calculate the amount 
of randomness that can be obtained from the two qubit 
Werner state, and from the isotropic two-qutrit state 
PAB = x|$^^)(<l>^i^^| -b (1 - u)]l/9, where = (|00) -b 

|11) -b |22 ))/a/ 3. In both cases we consider that Alice 
performs two mutually unbiased measurements (Pauli X 
and Z for qubits, and their generalisation for qutrits). 

For the case of no-losses, we observe that the amount 
of randomness that can be extracted is independent of the 
visibility v, and equal to 1 bit and 1 trit = log2(3) bits 
respectively^ This coincides with the amount which is 
obtained in the steering scenario for x = 1, i.e. the ideal 
case. This demonstrates that if knowledge of the state 
is assumed, then the lack of visibility cannot be used by 
Eve to guess the outcomes of Alice’s measurements. 

Turning to the case of losses, consistent with the above, 
we observe that, independent of the visibility, the depen¬ 
dence of the randomness on the loss coincides with that 
found in the steering scenario for perfect visibility. That 
is, the solid black curves in Figs. 3 and 4 are obtained, 
for any fixed value of the visibility v. 

This shows that the prepare-and-measure scenario 
greatly improves over the steering scenario when consid¬ 
ering lack of visibility (i.e. noise) on the state. 


^ More precisely, for all v > 0.05 we observed numerically that 
Pg < 0.339. 
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V. IMPROVING THE RANDOMNESS 
EXTRACTION 

The SDP (5) provides a way of quantifying the ran¬ 
domness in Alice’s outcomes given the observation of a 
given assemblage. A natural question is, given a fixed 
state distributed between Alice and Bob and a fixed num¬ 
ber of measurements for Alice, what is the best scheme 
they can implement (i.e. the best choice of measure¬ 
ments) which allows for the certification of the most ran¬ 
domness. 

Here we propose a numerical see-saw method that, 
starting from an initial amount of certified randomness, 
seeks for measurement schemes that lead to higher ran¬ 
domness certification. We focus on the case of local ran¬ 
domness. A similar scheme can also be implemented for 
global randomness. 

Every SDP has a dual program, also an SDP, that can 
be obtained through the theory of Lagrange multipliers 
[33]. The dual of (5) is equivalent to 

a,x 

S.t. Tr[aa'\x*] < y^Tr[Ea|xga|a;] 

a,x 

where in the constraint, 'i<Ja\x should be understood as 
for all non-signalling assemblages, i.e. those satisfying 
Y.a^a\x = Y.a^a\x' for all x' ^ X ^ . Since strong dual¬ 
ity holds, the optimal value of this optimisation problem 
is equal to the optimal value of (5), i.e. Pguessi^*) = 
Sa x Tr(E'*|^ cr°|]^). Moreover, it outputs the coefficients 
F*\^ of the optimal steering inequality that gives the tight 
upper bound on P*^^^^{x*). 

Once we have solved the dual problem (9) we can run 
a second SDP that optimizes the violation of the steering 
inequality x '^a\x) over Alice’s measurements 

\^^a\x^ax‘- 

min ^P^[{Ma\x® Fa\x)PAB\ (10) 


S.t. '^Ma\x = ^ 

y X 

Ma\x h 0 

Va, X 


The solution of this optimisation problem provides the 
measurements for Alice that allow for the certification of 
the most randomness using the steering inequality pro¬ 
vided by the first SDP. 

At this point, one can perform a see-saw iteration of 
the two SDPs in order to obtain the maximal random¬ 
ness that can be certified from a given state, along with 


® As written, this problem is not in the form of an SDP. In C we 
derive the dual SDP and show its equivalence to (9), which is 
easier to interpret. 


the optimal steering inequality and measurements Ma\x- 
For every given initial state, the SDP (5) (and its dual 
(9)) gives the best inequality to certify randomness from 
an assemblage, while the SDP (10) gives the best set of 
measurements - and therefore the best assemblage - for 
a given steering inequality. 

In Fig. 6 we plot the result of this see-saw iteration, 
starting from two randomly chosen projective measure¬ 
ments, for ry = 1 and rj = 0.9, for the two-qubit partially 
entangled state \tp) = cosdjOO) -|-sin0|ll). When there 
are no losses, one bit of randomness is already known to 
be possible from any partially entangled state in the fully 
device-independent scenario [40]. Since this scenario is 
more demanding, it implies one bit can also be obtained 
from any partially entangled state of two qubits in the 
steering scenario. If the method works it should be able 
to reproduce this result. As can be seen, 1 bit of ran¬ 
domness is indeed found, thus demonstrating the utility 
of the method. 

Further exploration showed numerically that the mea¬ 
surements which achieve I bit of randomness from any 
partially entangled state can always be taken to be X 
and Z measurements for Alice (with the randomness ob¬ 
tained from the X measurement)^. 

In the appendix we show that this numerical evidence 
can be turned into an analytic construction, which proves 
that 1 bit can be obtained from any partially entangled 
state of two qubits (which is notably completely different 
to the approach used in [40] for nonlocality). Moreover, 
the construction generalises to qudits in a straightfor¬ 
ward manner, showing that 1 dit of randomness can be 
obtained by performing two generalised Pauli measure¬ 
ments on any Schmidt-rank d state. This is contrary to 
the fully device-independent case, where it is only known 
how to extract 1 bit from pure partially entangled states. 

VI. CONCLUSIONS 

We have presented a method that certifies the optimal 
amount of local or global randomness that can be ex¬ 
tracted in a steering experiment. We also considered the 
case where the source is trusted (prepare-and-measure 
scenario). Our method relies on optimisation techniques 
that quantify the amount of certified randomness and 
provide the optimal steering inequality for randomness 
certification. Applying this method to realistic imple¬ 
mentations - i.e. in presence of noise and losses - we 
have shown that a detection efficiency above 50% is suf¬ 
ficient to have reliable local randomness certification in 
the steering scenario. This result is also valid for device¬ 
independent (DI) randomness certification and, in gen¬ 
eral, in scenarios with lower levels of trust. 


^ We do not present the form of the optimal steering inequalities 
for partially entangled states, since we did not find any general 
structure which makes knowing their form useful. 
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Finally, we have introduced a method which produces, 
for any given initial state, the optimal measurements 
which in turn give the optimal assemblage from which 
maximal randomness can be certified. Using this method 
as a starting point, we have shown analytically that 1 dit 
of randomness can be obtained from any pure entangled 
Schmidt-rank d state. 

Since local randomness certification is of fundamental 
importance for ISDIQKD and DIQKD, the results pre¬ 
sented here have natural applications in cryptographic 
protocols. 
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Appendix A: Obtaining the SDP for the guessing 
probability 

In this appendix we will show how to arrive at the SDP 
(5) for Eve’s guessing probability. 

The most general attack that Eve can implement in 
the case that she is interested in guessing the result of a 
single measurement (x = x*) of Alice, is to distribute a 



state pABE to Alice and Bob (keeping a part for herself) 
on which she will perform a measurement with POVM 
elements M^, for e = 0,... ,mA — 1, and distribute to 
Alice a set of measuring devices which implement the 
POVMs with elements Ma\x^ for a; = 0,..., ua — 1 and 
a = 0,... ,mA — 1- When Eve obtains outcome e from 
her measurement she will give this as her guess for the 
outcome of Alice. Thus, the guessing probability of Eve 
is given by 

Pguess{x*) = ^ Tr[(Ma^e|x* ® Me)pAE] (Al) 

e 

Alice and Bob can however determine the assemblage 
that they hold, (i.e. the set of conditional states 
prepared for Bob, along with the corresponding proba¬ 
bilities) . Thus the optimisation problem we need to solve 
is given by 

max V Tr[(M„=e|x* ® Me)pAE] (A2) 

e 

s.t. TrA[(M„|,r (g) 1 b) Pab] = cr°}L", Va,a: 

PABE ^ 0, Tr[pABE] = 1 

b 0,Va,a;, ^A4|,, = l,Va; 

a 

Me^0,Ve ^Me = l. 

e 

Here, the first constraint is the consistency with the ob¬ 
served assemblage, the second constraints demand that 
PABE is a valid quantum state and the third and fourth 
constraints that the measurements M^i^, and Mg are valid 
POVMs. 

Defining now the joint assemblage for Alice, Bob and 
Eve, 

^ajx = TrAE[(Afa|a, 0 1 b ® Mg) pabe], (A3) 

it is straightforward to see that all of the constraints 
appearing in (5) are satisfied whenever the constraints 
in (A2) are satisfied, and that the objective functions 
match. Thus it is straightforward to see that the optimi¬ 
sation problem (5) is at least a relaxation of (A2). What 
we will show now is that they are in fact equivalent op¬ 
timisation problems by showing that any solution to (5) 
also implies a solution to {A2). 

First of all, consider an assemblage satisfying all 
of the constraints in (5). For a fixed e, we can define 
^E(e) = EaTr<|,^ and = <|,/PE(e). 
the following properties 

a a 

TrE^:|. = l 


This has 

(A4) 


® Note that PeIe) is indeed independent of x, due to no-signalling, 
since independent of x. 


which show that for each e, is a valid assemblage 
[30]. From the GHJW theorem [34] it therefore follows 
that there is a quantum state p^B and POVM elements 
such that 

TrA[(M:p0lB)plB]=^:p (A5) 

Now, we finally consider that Eve also sends an addi¬ 
tional degree of freedom which is read by the measuring 
device of Alice - an auxiliary classical ‘flag’ system, which 
we label A'. This system has orthogonal states |e), for 
e = 0,..., TTiA — 1. This system will be read by Alice’s 
measuring device, and, conditioned on the flag, the ap¬ 
propriate measurement will be made. We can thus now 
construct the complete strategy of Eve 

PABE = ^ HE(e)|e)(e|A' 0 Pab O |e)(e|E 

e 

Maix = ^\e){e\A' ® 

e 

Mg = |e)(e|E (A6) 

Clearly this defines a valid state and valid measurements, 
hence they satisfy the latter constraints of (A2). Further¬ 
more, by construction it also satisfies the first consistency 
constraint, which is straightforwardly verified. 

In total, we thus conclude that the two optimisa¬ 
tion problems are equivalent, since the solution to either 
one implies a solution to the other, obtaining the same 
Pguess{x*). We thus focus on the problem (5) which is 
easier to solve, being an SDP optimisation, linear in the 
optimisation variables cr®|^. 


Appendix B: Derivation of the Prepare-and-Measure 

SDP 


In this appendix we will show that the amount of 
randomness that can be certified in the prepare-and- 
measure scenario when Alice receives her share of the 
state through an untrusted channel, and does not trust 
her measuring device, is given by the SDP (6) in the main 
text. 

Bob prepares a known bipartite state pab half of which 
is sent to Alice through the insecure quantum communi¬ 
cation channel. Eve can intercept the state, and the most 
general operation she can perform (in the case that she 
is guessing only the outcome of a single measurement 
X = X*) is a measurement with Kraus operators ATg, i.e. 
the POVM elements are Mg = and the state pre¬ 

pared by Eve after obtaining outcome e is 


Pab — 


(Kg 0 1 )pab(A:1 0 1) 
Tr[KgPAKl] 


(Bl) 


which occurs with probability P^ie) = Tr[MgpA]. Eve 
will guess that the outcome of Alice’s measurement is 
e. Eve now forwards the state onto Alice, and since she 




9 


controls completely Alice’s device, she will allow the de¬ 
vice to perform the measurement when her outcome 
was e, and when Alice chooses to make measurement x 
(that is, Eve sends the classical information of which out¬ 
come she obtained along with the quantum state). Thus, 
the probability for Alice to obtain outcome a, given that 
she made measurement x and Eve obtained outcome e is 
given by 


Pf^{a\x,e) 


nN:\.KePAKl] 

Ty[K,pj^kI] 


(B2) 


Putting everything together, we see therefore that the 
guessing probability is given by allowing Eve to optimise 
over all available strategies, and is given by 

Pgnessix*) = maxJ2PAK=e\x-PePAKl] (B3) 

e 

s.t. ^ 0 1)pab] = 

e 

= 1 V e, a; 

a 

Y,kIk, = i 

e 

K\xP0 Va,e,a; 

Currently, this optimisation is not in the form of an SDP, 
due to the nonlinear nature of the objective function and 
the constraints. However, it can easily be written in the 
form of an SDP by introducing the new variable = 

Kf.. The three final constraints on iV®, and 
imply the following constraints on Af®|^, 

a a 

T.^a\x = h yx, (B4) 

ae 

Va,e,a;. 

However, we can see that whenever we have a set of 
satisfying the above constraints, it implies that there 
exist A^®|,j, and satisfying the original constraints - 
i.e. the two sets are equivalent. To see this, we denote 
first Mf. = X)a-^a|£c — 0 (which is independent of a:), 
and therefore we can write Me = AT]Ale, for some Kg, 
which is always possible for a positive semi-definite op¬ 
erator. Moreover, since J2ae^a\x ~ 
second constraint is satisfied. Finally, defining = 

{KI)~^h 0 (using the pseudo-inverse when 
necessary), we also have that 


Thus, we can re-express the optimisation problem (B3) 
in the form of the following SDP 

Pguess{x*) = mp^ Tr[M®^g|,„.pA] (B6) 

a\x. e 

s.t.ETrA[(M®|,^ (g) 1 )pab] = Vo,a: 

e 

EK% = E^a%' Ve,x^x' 

a a 

E^^a% = l Vcr 

ae 

A/®|^hO Va,e,a: 

which is exactly the optimisation problem given in the 

main text. 


Appendix C: Deriving the dual of the SDP (5) 


In this appendix we show the explicit form of the dual 
of the SDP (5), and explain why Eq. (9) is an equivalent 
form, which is easier to interpret. 

As a reminder, the primal problem is given by 


= maxETr[cr®^g|^.] 

(Cl) 

O 4- \ ^ ^obs 

S.t.2_^Cr^|^ - 

Va, X 

^ ^ ^a\x ^ ^ ^a\x* 

y e, x ^ X* 

a a 

<\x p 0 

Va, X, e. 


Let us introduce dual variables Fa\x^ G% and with 
respect to the first, second and third set of constraints 
respectively, and form the Lagrangian for this problem. 


£ = E Tr[<=ep.] + E - E 

e ax e 

-f ETr[G®(a:|, -<|,.)] + (^2) 

aex aex 


After re-arranging, and grouping terms, this is equivalent 
to 


£ = ETr[Fa|Xr:] 

ax 


+ E Tr[((5o,e<5a:,a;* 1 “ Fa\x 




(C3) 


E^a% = (^l)-'Afe(iVe)-' 

a 

= [Kl)-^KlKe{Ke)-^ = 1 


This Lagrangian provides an upper bound on the primal 
objective as long as Pt^\^ F 0. Moreover, it provides 
a non-trivial upper bound only when the inner bracket 
in the second line identically vanishes for each value of 
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a, e,x. Thus, we arrive at the dual problem 


minETr[F„|^(T°{l/] 

(C4) 

S.t. Sa^e^x,x* 1 ^a\x ^x 



Va, e, X 

h:\x f 0 

Va, e, X 


However, is playing the role of a slack variable, since 
it doesn’t appear in the objective function, so we can 
finally simplify the dual to arrive at 

Pguess(x*) = ^min^ ^ nFa\.<y:\:] (C5) 

^ ax 

S.t. -falx ^a,e^x,x*^ Gj. 

+ t 0 'ia,e,x 

x' 

The dual is easily seen to be strictly feasible, for example 
by taking G® = 0 and Fa\x = ctl for a > 1. Thus strong 
duality holds, and the optimal value of the dual is equal 
to the optimal value of the primal. In the form (05), 
the dual is seen manifestly to be an SDP, as expected. 
Finally, to understand the meaning of the constraint, we 
multiply by an arbitrary valid assemblage aa\xj and take 
the sum in a and x and the trace. We find 

X! Fi[Fa\x(Ta\x\ > Tr[cre|x*] = P(e|a;*) (C6) 

ax 

must hold for all e. Since this condition also holds for all 
valid assemblages, we see that the second constraint en¬ 
forces that the value of the inequality is a uniform upper 
bound on the probability that any individual outcome 
occurs for the measurement a;*, independent of the as¬ 
semblage. Hence, one sees immediately why this bounds 
the guessing probability. 


where | fg) = cosdjO) -|-sin0|l). Crucially, each element 
of the assemblage is pure, i.e. each element is of the 
form a^jx = where H^jj^, is a one-dimensional 

projector. The purity of Bob’s assemblage substantially 
constrains Eve’s possible strategies, such that 

^alx = <l{ae\x)n^\x (D2) 

where each q{ae\x) > 0. This says that Eve must prepare 
the same pure state for Bob in each instance, all she can 
vary is the probability of the two outcomes (which must 
still be positive). To be consistent with the observed 
assemblage, we must have that 

''^q{ae\x) = P{a\x). (D3) 

e 

The guessing probability also now becomes 

TrK=e|o] = 9(00|0) + g(ll|0). (D4) 

e 

Now, the no-signalling constraint says that J2a ~ 
®’a|i Specifically, in the case at hand 

9(0e|0)no|o + g(le|0)ni|o = (/(OelljHgp -|- q(le|l)ni|i, 

. 

which must be true for all matrix elements. While the 
projectors on the right-hand-side, corresponding to mea¬ 
surements of Z, are diagonal, the left-hand-side, corre¬ 
sponding to X, are in general not diagonal. Thus, taking 
the trace with |1)(0|, we arrive at the condition 

cos0sin0(g(Oe|O) — q(le|0)) = 0. (D6) 

Since cosdsin0 ^ 0 for 9 S (0,7r/4], this implies that 
q(0e|0) = g(le|0). In particular, this says that (;(01|0) = 
q(ll|0). However, to be consistent (7(00|0) -I- (;(01|0) = 
p(0|0) = 1/2, and thus we arrive at 


Appendix D: Maximal Randomness from all pure 
states 

In this section we will show analytically that appropri¬ 
ate measurements on all partially entangled qudit states 
necessarily lead to I dit of randomness. 

Consider first the partially entangled two qubit state in 
Schmidt form, ji/) = cos0|OO)-|-sin0|lI), for 6 G (0,7r/4], 
and that Alice’s two measurements are X and Z mea¬ 
surements respectively. The assemblage created for Bob 
is then 


1/2 = q(00|0) + g(01|0) = g(00|0) -f g(ll|0) = Pg. (D7) 

Thus, analytically it must be the case that Pg = 1/2, and 
hence 1 bit of randomness is obtained by measuring X 
and Z on any partially entangled state of two qubits. 

The above also extends to qudits; assuming that the 
state has Schmidt-rank d then 1 dit of randomness can 
always be obtained. Let us now write the state as 

d-l 

W=Y.^Ak\k)\k) (D8) 


o'o|o - 21 te)(te I, 
^i\o = 2 I t-e)(t-e I, 

(Toll = cos^6»|0)(0|, 
(Till = sin^6»|l)(l|. 


where J2k = 1, and Xk > 0. Alice’s first measure¬ 
ment will now be in the Fourier transform basis, with 
eigenstates 


|d) 


1 

Vd 




fc =0 


(Dl) 


(D9) 
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and oj = the corresponding root of unity. Her 

second measurement will be in the Z basis with eigen¬ 
states {|a)}. For Alice’s first measurement she obtains 
each outcome with equal probability F’(alO) = 1/d, and 
prepares the pure states for Bob Haio, given by 

= (DIO) 

kl 

For Alice’s second measurement, she obtains outcome a 
with probability P{a\l) = Xa, and prepares the state 
Flail = |a)(a|. As above, the purity of Bob’s assem¬ 
blage means that Eve is again forced to use strate¬ 
gies of the form cr®|^ = ( 7 (ae|a;)n£j|a;. For consistency 
we still have J^edio-slx) = P{a\x), for the guessing 
probability Pg = from no-signalling 

Ea <?(ae|0)na|o = Ea 9(ae|l)na|i. Once again, the right- 
hand-side is diagonal, and hence by looking at the off- 
diagonal matrix elements, i.e. by taking the trace with 
|fc)(^|, we find that 

^ <7(ae|0)yAfcEw“^'-'=^ = 0 (Dll) 


Since, by assumption of being Schmidt-rank d, none of 
the Schmidt coefficients vanish, we therefore must have 
that 

= 0. (D12) 

a 

Considering only the elements with k = 0 (and I = 
1,..., d— 1), along with the equation J2a dC^^jO) = P{e), 
which says that Eve’s probability to output e is just the 
marginal distribution, we notice that this set of equa¬ 
tions, when combined, has the familiar form of a discrete 
Fourier transform (up to normalisation): 


■ 1 1 .. 

1 ■ 


g(0e|0) 


■ P{e) ' 

1 w 



g(le 0) 

— 

0 

_1 . . 



. q{d- l,e|0) _ 


0 


(D13) 

Thus, this equation is readily inverted, and we obtain 
as solution q{ae\0) = P{e)/d for all a,e. In partic¬ 
ular, this implies that Eve’s guess is completely un¬ 
correlated from Alice’s, and her guessing probability is 
Pg = Ee9(ee|0) = \ Y.eP{^) = Thus 1 dit of 

randomness is obtained from Alice’s measurement. 



